[35C4n0r]

Closes REG-87

Refactor harleylrn/kiro-cli to install and configure Kiro CLI only, matching the claude-code, codex, copilot, and cursor-cli (#1152) migrations. Changes beyond the AgentAPI removal are limited to what the current Kiro docs require.

• Replace the agentapi module with coder-utils; drop Tasks/web-app inputs (order, group, report_tasks, cli_app, web_app_display_name, cli_app_display_name, install_agentapi, agentapi_version, agentapi_chat_based_path, ai_prompt, system_prompt, coder_mcp_instructions, trust_all_tools), the task_app_id output, the start script, the default agent template, and the task-reporting coder MCP server.
• Install with the documented installer (https://cli.kiro.dev/install) for latest. A pinned kiro_cli_version or custom kiro_install_url installs <url>/<version>/kirocli-<arch>-linux.zip (default host desktop-release.q.us-east-1.amazonaws.com, as before). Runs on every start when install_kiro_cli = true (existing binaries are removed first because the official installer prompts on /dev/tty otherwise); with false, kiro-cli must be on PATH.
• workdir is optional and created if missing.
• agent_config is written to ~/.kiro/agents/<name>.json (honors KIRO_HOME) and set with kiro-cli settings chat.defaultAgent. MCP servers go in its mcpServers field, so there is no separate mcp input. Without it, Kiro's built-in default agent is used.
• Add api_key (KIRO_API_KEY, documented auth method). auth_tarball is read from KIRO_CLI_AUTH_TARBALL at install time instead of being rendered into the script.
• Add scripts output; README reduced to examples and doc links; rewrite tests. Bump to 2.0.0.

Important

MCP servers connecting was not verified: Kiro disables MCP unless signed in to a real account, and none was available. kiro-cli mcp add --agent writes the same inline mcpServers structure the module writes.

Decision log

Topic	Kiro CLI reality	Decision
Install	Docs recommend curl -fsSL https://cli.kiro.dev/install | bash (latest only, glibc/musl detection); zip install documented at desktop-release.../latest/; versioned paths exist	Installer for latest, release zip for pinned versions/mirrors
MCP	Agent config mcpServers has the highest precedence; kiro-cli mcp add needs login	No mcp variable; use agent_config.mcpServers
Default agent	kiro-cli settings chat.defaultAgent works without login and preserves other keys	Use the CLI (as the original module did), no jq
Validations	Not present before	None added; version and agent name are base64-encoded into the script
Auth	Browser login first, then KIRO_API_KEY	Add api_key; keep auth_tarball
Config dir	KIRO_HOME overrides ~/.kiro	Honored for the agent file

Testing

• terraform test (6 passed), bun test main.test.ts (14 passed, container-based), terraform fmt, prettier, shellcheck
• Dogfood workspace from a test template: official install (2.30.0), PATH and CODER_SCRIPT_BIN_DIR symlink, script order with a downstream coder exp sync script, agent file written and listed as default by kiro-cli agent list, user settings preserved, KIRO_API_KEY set and absent from scripts/logs, restart, pinned 2.29.0 downgrade via release zip, API key rotation

---

Generated with Coder Agents.

[github-actions]

Module Scorecard Check

harleylrn/kiro-cli: first scorecard, 66 / 100

No specific score is required to contribute, but modules with higher scores are more likely to be approved by the Coder team and widely used.

Full scorecard for this PR

Presentation & Onboarding	Agent Integration	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	10 / 25	20 / 20	12 / 20	7 / 10	66 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README shows distinct documented modes: standalone launcher (coder_app), custom agent config with MCP servers, pinned version/internal mirror, and downstream script serialization via scripts output — each with sensible defaults and context.
Visual preview	5	0	No image, GIF, or video anywhere in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	auth_tarball and api_key are sensitive = true; all README examples reference var.kiro_cli_auth_tarball/env vars rather than inline literal secrets, and tests assert secrets never land in rendered scripts.
Non-hardcoded auth path	4	4	README documents kiro-cli login flow and generating a pre-authenticated tarball as alternatives to hardcoding API keys.

Restricted-Environment Readiness — 12 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	kiro_install_url variable overrides the base download URL used in install_from_archive (${base_url}/${ARG_VERSION}/kirocli-${arch}-linux.zip); README's "Pinned version or internal mirror" example demonstrates pointing it at https://artifacts.internal.corp/kiro-cli-releases.
Bring-your-own binary	10	5	install_kiro_cli = false variable and ensure_kiro_in_path fallback fully support a baked-in binary (confirmed in main.tf and tests), but README never shows an example setting this variable — only described in the variable's inline description, not in a README example/section.
Egress transparency	3	0	No dedicated README section enumerating install/runtime endpoints (cli.kiro.dev, desktop-release.q.us-east-1.amazonaws.com, custom mirror); URLs only appear scattered inside unrelated config examples.
Runs without sudo	2	2	Install script (install.sh.tftpl) never invokes sudo anywhere; all operations target $HOME.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All variables have clear descriptions and sensible defaults (e.g., install_kiro_cli = true, kiro_cli_version = "latest"), but no validation blocks exist anywhere in main.tf despite opportunities (e.g., validating agent_config JSON or kiro_cli_version format).
Test coverage	4	4	main.tftest.hcl covers business logic (defaults, workdir trimming, env var creation, scripts ordering) and main.test.ts covers end-to-end install/auth/agent-config behavior in containers.

Agent Integration — 10 / 25

Criterion	Max	Score	Notes
AI governance	10	0	No mention of Coder AI Gateway or Agent Firewall anywhere in the README.
Dashboard entry point	5	5	README's "Standalone mode with a launcher app" example defines a full coder_app resource (slug, display_name, icon, open_in, command) launching kiro-cli chat.
Session continuity	5	0	No documentation of resuming sessions, session IDs, or a persistent session manager (tmux/screen/boo).
Managed configuration	5	5	agent_config variable documents writing an agent JSON (tools, MCP servers like playwright) and setting chat.defaultAgent, matching Kiro's agent-configuration format.

Overall — 66 / 100

Raw 61 / 92 → round(61 / 92 × 100) = 66

Tip

You can run this locally by telling your agent: "review this module against .github/scorecard/SCORECARD.md".

---

Scored against SCORECARD.md with solstice-1. Language-model scores are advisory.

[linear-code]

REG-87

[matifali]

always use - in names and not _

[coder]

Automated review requested by @matifali. Please sanity-check before acting on it.

• URL: refactor(registry/harleylrn/modules/kiro-cli)!: remove agentapi, tasks and start logic #1161
• Head SHA reviewed: a62df4ab74bb2a26124b8bd9fac776ba674645b5 (draft)
• Verdict: approve with nits. Two should-fix items (upgrade leftovers and the migration note) should land before it leaves draft.

Summary

The agentapi module is replaced with coder-utils@0.0.1. The start script, coder_ai_task/task_app_id, CODER_MCP_APP_STATUS_SLUG, the coder MCP server that called coder_report_task, the default agent template, and every Tasks/web-app input are removed. Kiro is installed with the official installer for latest, or from the release zip for a pinned version or mirror. api_key is new and workdir is now optional. Version goes 1.0.2 → 2.0.0 in all 5 README examples, which is correct for a breaking change.

Correctness

• main.tf (122 lines) is self-consistent: every local and variable it references exists, and templatefile passes exactly the 6 args the template uses. The scripts output has a description. Secrets are sensitive and delivered only through coder_env.
• The install flow makes sense: validate, or install and skip when a matching version is present, then workdir, auth tarball, agent config.

Leftovers

• None in module code. A grep for report_task|agentapi|coder_ai_task|APP_STATUS|AGENTAPI_URL|3284|app_slug|ai_prompt|task_app|exp mcp|coder_task only hits the README migration note and the test helper import (see nit N4).

Findings

should-fix S1: upgraded workspaces keep the v1 Tasks agent as Kiro's default. scripts/install.sh.tftpl:234-238
v1 wrote ~/.kiro/agents/agent.json, a default agent with @coder tools and a coder MCP server: coder exp mcp server --allowed-tools coder_report_task with CODER_MCP_APP_STATUS_SLUG, CODER_MCP_AI_AGENTAPI_URL=http://localhost:3284, and a baked-in CODER_AGENT_TOKEN. It also ran kiro-cli settings chat.defaultAgent agent. In v2, with no agent_config, configure_agent returns early, so on a persistent home Kiro keeps loading that stale agent. Its MCP server points at a removed tool, AgentAPI, and an expired token. That contradicts the README (line 22), which says Kiro's built-in default agent is used.
Fix: when agent_config is unset and $KIRO_DIR/agents/agent.json is the legacy module file (e.g. its mcpServers.coder.args contain coder_report_task), remove it (or just its coder server) and clear chat.defaultAgent. Alternatively, document the manual cleanup in the migration note. Even with agent_config set, kiro-cli mcp remove --name coder --agent agent is worth running to clear the stale token-bearing entry.

should-fix S2: the migration note is incomplete compared with auggie and the AGENTS.md checklist ("Breaking changes documented: removed inputs, changed defaults"). README.md:22
It only names ai_prompt, system_prompt, and trust_all_tools. Missing:

• Removed inputs: order, group, report_tasks, cli_app, web_app_display_name, cli_app_display_name, install_agentapi, agentapi_version, agentapi_chat_based_path, coder_mcp_instructions
• The removed task_app_id output
• workdir is now optional and only created; it's no longer the launch directory
• Changed default and egress: kiro_install_url now defaults to null, and latest now downloads https://cli.kiro.dev/install instead of the desktop-release.q.us-east-1.amazonaws.com zip. Air-gapped or allowlisted deployments that relied on the old host need to know.

The auggie README warning (#1177, line 22) is a good template.

nit N1: pinned/mirror install dropped --no-confirm and doesn't detach stdin. scripts/install.sh.tftpl:151
v1 ran ./kirocli/install.sh --no-confirm. v2 runs KIRO_CLI_SKIP_SETUP=1 sh .../install.sh with inherited stdin. The PR says a downgrade was tested, but keeping --no-confirm and adding < /dev/null (as the official-installer path does at line 104) protects against the overwrite prompt the comment at lines 101-103 warns about.

nit N2: a broken existing binary aborts silently. scripts/install.sh.tftpl:170
Under set -euo pipefail, if kiro-cli --version fails, current=$(installed_kiro_version) exits the script with no message. Use current=$(installed_kiro_version || true) so it falls through to a reinstall.

nit N3: agent name isn't validated or tested. main.tf:101
try(jsondecode(var.agent_config).name, "agent") is used as a filename: a name like ../x writes outside agents/, and invalid JSON silently becomes agent.json. Old agent_name_extraction tftest coverage was dropped. Add a validation (can(jsondecode(var.agent_config)), plus a name regex such as ^[A-Za-z0-9_-]+$) and a tftest asserting base64encode("agent") when name is absent.

nit N4: tests still import from the agentapi module. main.test.ts:18-21 imports extractCoderEnvVars/writeExecutable from ../../../coder/modules/agentapi/test-util. claude-code does the same, so this is series-wide. If agentapi is later deleted, these tests break. Consider moving the helpers into ~test.

nit N5: provider constraint. main.tf:7 says coder >= 2.12, but coder-utils requires >= 2.13. Bump it for accuracy. (coder-utils README now shows 0.0.2; the whole series pins 0.0.1, so the bump is fine to leave to the series.)

nit N6: there's no README example for install_kiro_cli = false (bring your own binary), and no egress list. The scorecard flagged both.

Tests

• kiro-cli.tftest.hcl (Tasks-centric) is replaced by main.tftest.hcl with 6 runs: defaults, workdir trim, api_key and auth_tarball env vars not rendered into the script, and scripts ordering.
• main.test.ts was rewritten with 14 container tests covering bring-your-own binary, official installer, pinned archive, mirror, version match skip, download failure, workdir, agent config, no-agent-config, tarball extraction, zstd requirement, secret isolation, and pre/post scripts. Good, meaningful coverage.
• Gaps: agent-name default (N3); upgrade-from-v1 cleanup (S1); kiro-cli settings failure handling.

CI and reviews

• Passing: Validate Terraform output (runs TS tests, terraform tests, validate, shellcheck), lint, Check for typos and unformatted code, Validate README files.
• Compare module scores against main was still in progress. The scorecard bot gave 69/100; its note about a tmux NOTE suggests it scored an earlier commit.
• No human reviews or review comments, so nothing is unresolved. Only bot comments: Linear linkback and scorecard.

Series consistency

Consistent with claude-code and the rest of the series: coder-utils@0.0.1, module dir $HOME/.coder-modules/<ns>/<name>, optional workdir, scripts output, .tftpl with base64 args, README launcher coder_app example, required_version >= 1.9.

[35C4n0r]

Addressed review feedback in 3cc4dd1 and 27a7e5b:

• Hyphenated module names (@matifali): README examples now use module "kiro-cli" and module.kiro-cli.scripts.
• Installed-version check removed (automated review N2): with install_kiro_cli = true the module always installs, matching the other agent modules, so a broken existing binary no longer makes the script exit silently. The official installer prompts on /dev/tty when kiro-cli already exists (no --force bypass on Linux), so the existing binaries are removed first. A new test installs twice to cover restarts.
• Migration note (automated review S2): lists the removed inputs and the task_app_id output, notes workdir is optional, and calls out that latest now installs from https://cli.kiro.dev/install while pinned versions still use desktop-release.q.us-east-1.amazonaws.com.

Re-tested in a dogfood workspace on the latest head: Kiro CLI 2.32.0 installed, scripts ran in order before a downstream coder exp sync script, agent written and set as default with user settings preserved, KIRO_API_KEY set. Restart reinstalled cleanly over the existing binary, and switching to a pinned 2.29.0 and back to latest worked.

@DevelopmentCats could you review?

Generated with Coder Agents.